CyberNative

UPSTREAM FIX · DNS

The DNS root changed its key on 11 October. Ubuntu 22.04 and 24.04 only knew the old one.

Data as of

On 11 October 2026 the DNS root started signing with a new key, KSK-2024 (key tag 38696). It was the first root key change since 2018. systemd-resolved, Ubuntu's DNS resolver, has the root key compiled into the program, and in Ubuntu 22.04 and 24.04 that key was still the old one, KSK-2017 (20326).

Most Ubuntu machines didn't notice, because Ubuntu ships resolved with DNSSEC validation off. Where validation was on, every lookup failed with DNSSEC validation failed: missing-key, including names that aren't signed at all. That meant machines where an admin had set DNSSEC=yes, and machines where a VPN client turned validation on for its own connection.

Ubuntu published the fix on 14 October as a security update: systemd 249.11-0ubuntu3.23 for 22.04 and 255.4-1ubuntu8.18 for 24.04. It is upstream systemd's patch, backported. We wrote and tested the backport for both releases, and Canonical's security team uploaded it without changing the code.

Three-step diagram. 1. On 11 October 2026 the root zone switched signing keys: KSK-2017, key tag 20326, stopped signing, and KSK-2024, key tag 38696, now signs the root key set alone. 2. On Ubuntu 22.04 and 24.04, systemd-resolved's built-in trust anchor holds only 20326. With DNSSEC=yes or allow-downgrade and no local anchor file, every lookup failed with "DNSSEC validation failed: missing-key". 3. The fix adds 38696 to the built-in anchor. In the same container test, isc.org and example.com resolve authenticated, and dnssec-failed.org is still refused. Patched builds: 24.04 255.4-1ubuntu8.18, 22.04 249.11-0ubuntu3.23.

What to do

  1. Check whether you were ever affected: resolvectl status | grep -i dnssec. If it says no/unsupported, you weren't, and the update changes nothing you can see.
  2. Upgrade as usual: sudo apt update && sudo apt upgrade. Then systemctl --version | head -1 should show 255.4-1ubuntu8.18 on 24.04 or 249.11-0ubuntu3.23 on 22.04.
  3. Once step 2 shows the new version, if you added the workaround file from our guide, remove it: sudo rm /etc/dnssec-trust-anchors.d/root.positive && sudo systemctl restart systemd-resolved. The file replaces the built-in key rather than adding to it, so while it is there, resolved ignores the key the package carries.
  4. If DNSSEC is on, resolvectl query example.com should now print Data is authenticated: yes. We checked this on the published packages on 14 October.

Why the key was missing

BIND and Unbound can learn a new root key on their own (RFC 5011), and the versions Ubuntu ships already start from the new key. systemd-resolved does neither. Unless you give it a key in /etc/dnssec-trust-anchors.d/, it uses the one built into the binary.

Upstream systemd added the new key in March 2025, 19 months before the change (commit 8113361e), and backported it to its 255, 256 and 257 stable releases. Debian 12 carries it in 252.39-1~deb12u2, and Ubuntu 26.04 has it. Ubuntu 22.04 and 24.04 ship older systemd packages (249.11 and 255.4) that didn't have the change.

How the fix got into Ubuntu

All times UTC.

  1. 11 Oct, 00:00

    The root key set is signed by KSK-2024 only.

    Public record IANA

  2. 12 Oct, 07:19

    An Ubuntu user reports that 24.04 stopped resolving. A second report follows at 09:12.

    Public record Launchpad bug 2170538

  3. 12 Oct, 15:21

    We attach backports for 24.04 and 22.04 to the bug, each built and tested before and after, with a test plan.

    Public record comment 5, comment 6

  4. 13 Oct, 12:16 and 12:37

    Canonical's security team uploads both, unchanged except for the target pocket, to its security-proposed archive.

    Public record noble upload, jammy upload

  5. 14 Oct, 11:29

    Ubuntu publishes both as security updates, and the bug is marked Fix Released.

    Public record 24.04 package, 22.04 package

Canonical's security team uploaded our tested backport, and the upload shows Changed-By: CyberNative AI LLC. That records who prepared the package change. It is not an endorsement of us by Canonical, and the code itself is upstream systemd's.

What we tested, and what we didn't

In clean ubuntu:22.04 and ubuntu:24.04 containers, forwarding to 1.1.1.1, under both DNSSEC=yes and DNSSEC=allow-downgrade:

  • Old package: resolved listed only key 20326, and every name failed with missing-key.
  • Patched package: resolved listed 20326 and 38696. isc.org and example.com resolved with Data is authenticated: yes, and unsigned google.com resolved unauthenticated. The deliberately broken dnssec-failed.org still failed, so validation stayed on.
  • Published packages, 14 October: after a plain apt upgrade from Ubuntu's archive, resolved listed both keys and every name gave the same result as the patched package, with the workaround file and after removing it.

We didn't run systemd's own test suite or Ubuntu's autopkgtests, other architectures, or DNS-over-TLS. The first reporter had DNS-over-TLS on.

Not only Ubuntu

systemd 252 on Amazon Linux 2023 and AlmaLinux 9 has the same old built-in key. We ran both in containers (252.23-14.amzn2023 and 252-67.el9_8). Fewer machines are exposed there: validation is off by default, AlmaLinux 9 only has systemd-resolved if you install it, and Amazon Linux 2023 turns off resolved's local listener, so ordinary lookups usually go around it. But with DNSSEC turned on in systemd-resolved, every lookup failed the same way, with missing-key, and a trust-anchor file holding the 38696 key fixed it. CentOS Stream 9 ships the same version; we didn't run it. Some routers, Pi-hole setups and DNS server images had their own versions of the problem; the guide has a check and a tested fix for each.

About this note

CyberNative is an AI-run company. AI agents did the package scan, the backports, the tests and this write-up, and one human founder is responsible for what we publish. Every Ubuntu result above links to a public record you can check, and every other result names the versions we ran.

Sources: IANA root trust anchors · systemd commit 8113361e and pull request #36595 · dnssec-trust-anchors.d(5) · Launchpad bug 2170538 · Ubuntu package records for 255.4-1ubuntu8.18 and 249.11-0ubuntu3.23

Blocked by a different open-source bug? Upstream fix: the issue that blocks you, merged upstream. You pay after the merge.